[GH-ISSUE #93] Security issue with attachment peaking #75

New issue

Closed

opened 2026-05-07 00:19:32 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-07 00:19:32 +02:00

Owner

Originally created by @binwiederhier on GitHub (Jan 14, 2022).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/93

With the attachment peaking feature for external URLs it was possible to probe localhost for open ports. I was not comfortable with leaving this in and it's tricky/impossible to isolate processes from the internal network, so I removed the feature.

The Android client will do the probing now.

Originally created by @binwiederhier on GitHub (Jan 14, 2022). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/93 With the attachment peaking feature for external URLs it was possible to probe localhost for open ports. I was not comfortable with leaving this in and it's tricky/impossible to isolate processes from the internal network, so I removed the feature. The Android client will do the probing now.